CVE-2026-33267 — Apache Traffic Server untrusted @ header → internal metadata spoof

CVSS 10.0 (Critical) · CWE-20 · GHSA-jrh6-9hgv-mqm7

Summary

Apache Traffic Server reserves @-prefixed headers (@Ats-Internal, @ICAP-Status, @TCPInfo, ...) for internal metadata: they live in the in-memory header structure but are never serialized on the wire. In vulnerable versions (9.2.0–9.2.14, 10.1.0–10.1.3) these headers coming from the client request and the origin response are not stripped before plugin hooks run (TS_HTTP_READ_REQUEST_HDR_HOOK, TS_HTTP_READ_RESPONSE_HDR_HOOK, remap plugins). A remote attacker can spoof ATS internal metadata; plugins (cache, ACL, header_rewrite, …) may then trust attacker-controlled internal state — impact depends on the plugins in use.

Fix

• 9.2.x: commit a9aee837db — "CVE-2026-33267: 9.2.x: Strip external @ headers before plugin hooks"
• master/10.1.x: commit 4ab63dbd93 — same fix
• New HttpTransact::strip_at_headers() runs before READ_REQUEST_HDR / READ_RESPONSE_HDR hooks; counters proxy.process.http.client_request_at_headers_stripped / proxy.process.http.origin_response_at_headers_stripped added.

Verification (2026-08-12, RPi5 arm64, Docker)

Custom at_probe plugin logging @ headers at both hooks, plus a raw-socket client (curl silently drops @ headers):

Negative control on the fixed build: 0 plugin observations (the plugin never sees the headers).

Usage

python3 at_headers_spoof.py 127.0.0.1 8080 /

Sends GET / with @Ats-Internal: pwned and @Another-At: test over a raw socket and prints the response head. On vulnerable ATS the custom plugin (or any @-metadata-trusting plugin) receives the spoofed headers; on fixed builds they are stripped before hooks.

Impact notes

• Public advisories describe the metadata-spoof primitive; the practical RCE chain depends on which plugin trusts which @ metadata on the target deployment (e.g. header_rewrite/cache directives referencing @ fields).
• This repo demonstrates and verifies the primitive (leak vs. strip) on both vulnerable and fixed builds.

References

• Apache advisory: https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d
• GHSA: https://github.com/advisories/GHSA-jrh6-9hgv-mqm7
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33267
• Fix 9.2.x: a9aee837db · Fix 10.1.x: 4ab63dbd93